Network devices typically use flow tables to track the state of data flows. Flow tables use layer 3 and layer 4 information in packet headers to identify and track individual flows. When packets are fragmented, however, layer 4 information is only carried in the first packet. Second and subsequent packets carry layer 3 information, but not layer 4 information. As a result, a simple flow mapping system (e.g., one that operates based on layer 3 and layer 4 information) does not work for fragmented flows.